Siemens Software Center CVE-2026-110936: update and check your PC

Most people have never opened Siemens Software Center. If you use Siemens desktop software (CAD, CAM, or related tools) on a home or student PC, or if weird “Siemens” installers showed up after a fake CAPTCHA, this one matters. On October 20, 2026, CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog. Siemens had already confirmed active exploitation.

What the bug is

Siemens advisory SSA-580366 describes an uncontrolled search path issue (DLL sideloading) in Siemens Software Center. In plain terms: older builds can load helper libraries from a folder the attacker controls. That can lead to code running with the privileges of Siemens Software Center. Siemens rates it a local attack: someone has to get their files onto the PC first, which is exactly what the fake installers below do.

• Affected: Siemens Software Center all versions before V4.0.9.8
• Fixed: V4.0.9.8 or later
• Scores in the advisory: CVSS v3.1 6.7, CVSS v4.0 8.4
• Reporter credited: Jose Oregon from Huntress Labs

Siemens says existing Software Center installs auto-update on the next startup. You can also download the current build from Siemens’s Software Center page linked in the advisory.

How attackers are using it (what Siemens published)

Siemens’s October 19 ProductCERT post is the source for the campaign details below.

Siemens says attackers used a genuine, signed copy of Siemens Software Center and placed their own DLL files next to it. The Siemens program itself was not modified. Vulnerable versions loaded those helper DLLs when the app started. Siemens attributes the activity to a Romulus multi-platform ClickFix campaign.

Siemens also states that, to its knowledge, no Siemens system, product, or update channel was breached. The malicious bundles were supplied outside official channels.

For home users, the practical lesson is blunt:

• Only install Siemens tools from official Siemens downloads.
• Never paste a command from a webpage into Win+R, the Run box, or PowerShell. Siemens’s own “what everyone should do” list calls that out. A real “I am not a robot” check never asks you to run shell commands. That same ClickFix theme showed up in Google’s recent Chrome Enhanced Protection scam note.

What to do on your own Windows PC

1. If you use Siemens Software Center, start it so it can auto-update, or install 4.0.9.8+ from Siemens’s official Software Center download linked in SSA-580366.
2. Confirm you are not running a random SiemensSoftwareCenter.exe from a ZIP, MSI, or “crack” pack you did not get from Siemens.
3. If you never installed Siemens software and you still see Siemens Software Center in Startup apps or Task Scheduler, treat that as suspicious (Siemens lists that as a warning sign).
4. Review Siemens’s published warning signs on the ProductCERT post if you think you were tricked by a ClickFix page. Examples Siemens lists include unexpected folders under AppData\Local\Programs, odd files next to SiemensSoftwareCenter.exe, a FTSuite folder containing ftc.uml under AppData\Local, and network connections to 96.62.218[.]59.
5. If you find clear signs of compromise: disconnect the PC from the network, stop the suspicious process, remove the startup entry or task, and change passwords for accounts used on that machine (from a clean device). Reinstall Windows if you cannot trust the box.

You do not need to memorize Siemens’s indicator table to stay safer. Updating Software Center, avoiding pasted “fix” commands, and refusing unofficial Siemens installers cover most home risk.

How this fits the October 20 KEV batch

CISA’s October 20 alert also added four Plex Media Server CVEs and one SiteGuard Server Edition issue. Plex is the other home-lab item in that batch; we covered it separately in Plex2Shell: update your home Plex Media Server today. SiteGuard is a server WAF product most home users never run, so this article stays on Siemens Software Center.

Do this / don’t do that

Do

• Update Siemens Software Center to 4.0.9.8 or later if you use it.
• Download Siemens software only from official Siemens sources.
• Treat unexpected Siemens Software Center startup entries as a reason to investigate.
• Keep everyday Windows patching current on the same PC.

Don’t

• Do not paste webpage “verification” commands into Run or PowerShell.
• Do not run Siemens installers from random forums, Discord drops, or “AllMyBasic”-style bundles.
• Do not assume “it is signed by Siemens” means the whole folder is safe. Siemens says the signed EXE was the carrier; the bad code was in adjacent DLLs.
• Do not ignore a PC that suddenly shows Siemens tooling you never installed.

Bottom line

CVE-2026-110936 in Siemens Software Center is fixed in 4.0.9.8+, confirmed exploited, and listed in CISA’s KEV catalog on October 20, 2026 (SSA-580366, Siemens ProductCERT post, CISA alert). On a home PC: update Software Center if you use it, refuse ClickFix paste prompts, and only install Siemens tools from Siemens. If Siemens Software Center appeared on a machine that never had it, investigate before you shrug it off.

Image: Siemens Software Center illustration from the official product page (sw.siemens.com).